CVE-2026-102657: esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal
esm.sh is a no-build content delivery network (CDN) for web development. Prior to server version 1377, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying that the result remains inside the configured application directory. URL-encoded dot segments such as %2e%2e bypass the plain traversal redirect performed by Go's ServeMux, allowing an unauthenticated remote attacker to make the server open and return files outside Config.AppDir that are readable by the server process. The confirmed impact is file disclosure only, and the issue is reachable with Dev disabled. This issue is fixed in server version 1377.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
esm.shto a version that resolves this vulnerability.Fixed in 137_7
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the documented web.NewHandler static file server are affected before server version 137_7. The vulnerable path is reachable even when Dev is disabled.
Does an attacker need authentication or local access?
No. An unauthenticated remote attacker can exploit the issue by requesting a crafted URL containing encoded dot segments such as %2e%2e.
What data can be exposed?
The server can open and return files outside Config.AppDir if those files are readable by the server process. The confirmed impact is file disclosure only.
What should be done if upgrading is not immediately possible?
The provided information identifies server version 137_7 as the fix. No alternative mitigation is specified.